11/06/2026
🎣 𝗡𝗲𝘄 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗞𝗶𝘁 𝗧𝗿𝗶𝗰𝗸𝘀 𝗦𝘁𝗮𝗳𝗳 𝗜𝗻𝘁𝗼 𝗛𝗮𝗻𝗱𝗶𝗻𝗴 𝗢𝘃𝗲𝗿 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗔𝗰𝗰𝗲𝘀𝘀
A phishing kit called SkyW4lker is spreading fast and it does not need to steal your password or beat your multi-factor authentication. It tricks an employee into typing a real Microsoft sign-in code on a real Microsoft page, and that single click hands attackers a working login session. Researchers at ANY.RUN tracked 618 cases of this kit between June and October 2026, with monthly activity jumping from 20 to 200.
This matters because nearly half of all known targets are in the United States, more than any other country, and the kit is dressed up to look like routine business. It arrives as a password-protected PDF, Word doc, or spreadsheet labeled as a contract, invoice, or payment notice, with links hosted on trusted sites like Google Sites, Miro, and Zoom so they slide past normal filters.
For a business owner, the takeaway is simple: MFA alone will not catch this one, because the employee is completing a real, legitimate login step without realizing they just gave an attacker the keys. One compromised mailbox can expose contracts, financial records, and your customers, since the attacker can use it to send convincing phishing from a trusted address.
❓Would your team know not to approve a sign-in code from an email they were not expecting?
📲Reach out to CinchOps and we will review your Microsoft 365 security settings and employee training before this kit finds its way into your inbox.
🌐 cinchops.com/contact | 📲 281-269-6506
Full Article: https://cybersecuritynews.com/skyw4lker-phishing-campaign-expands-threatening-us-enterprises-with-microsoft-365-account-takeovers/
